The vulnerability arises when the Typer command used by PraisonAI's recipe serve starts an HTTP server on any network interface without enforcing authentication. Because the configuration lacks an authentication component, the server does not attach the API‑key or JWT middleware, exposing the recipe API and, if enabled, the /admin/reload endpoint to unauthenticated clients. Attackers can exploit this flaw to read or modify recipe information and potentially trigger server reloads, compromising confidentiality, integrity, and availability. The weakness aligns with missing authentication for externally reachable services (CWE-287), insecure configuration (CWE-306), and insufficient authorization controls (CWE-862).

The flaw is present in MervinPraison’s PraisonAI from version 4.5.112 up to, but not including, version 4.6.59. The issue was addressed in version 4.6.59. Users should verify they are running a patched version and update accordingly.

PraisonAI exhibits a high CVSS score of 8.2, indicating significant impact. The exploit requires executing the deprecated Typer command, which can be performed locally or via a remote shell if the host is compromised. Once executed, the Recipe HTTP server listens on a non‑localhost interface, making it reachable from external networks. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication combined with an externally exposed service raises a substantial risk for unauthorized access and potential remote code manipulation. Regular monitoring and network segmentation can mitigate immediate exposure while a patch is applied.